CVE-2019-16251: plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

medium Affects yith-advanced-refund-system-for-woocommerce (WordPress plugin), yith-color-and-label-variations-for-woocommerce (WordPress plugin), yith-custom-thank-you-page-for-woocommerce (WordPress plugin), yith-desktop-notifications-for-woocommerce (WordPress plugin), yith-paypal-express-checkout-for-woocommerce (WordPress plugin), yith-pre-order-for-woocommerce (WordPress plugin) and 32 more. Feed 2026.10.29.1, updated 2026-10-28; published 2019-10-31; advisory modified 2026-06-17.

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-advanced-refund-system-for-woocommerce (WordPress plugin) WordPress
Affected versions: <=1.0.10
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-color-and-label-variations-for-woocommerce (WordPress plugin) WordPress
Affected versions: <=1.8.11
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-custom-thank-you-page-for-woocommerce (WordPress plugin) WordPress
Affected versions: <=1.1.6
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-desktop-notifications-for-woocommerce (WordPress plugin) WordPress
Affected versions: <=1.2.7
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-paypal-express-checkout-for-woocommerce (WordPress plugin) WordPress
Affected versions: <=1.2.5
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-pre-order-for-woocommerce (WordPress plugin) WordPress
Affected versions: <=1.1.9
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-product-size-charts-for-woocommerce (WordPress plugin) WordPress
Affected versions: <=1.1.1
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-added-to-cart-popup (WordPress plugin) WordPress
Affected versions: <=1.3.11
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-advanced-reviews (WordPress plugin) WordPress
Affected versions: <=1.3.9
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-affiliates (WordPress plugin) WordPress
Affected versions: <=1.6.3
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-ajax-search (WordPress plugin) WordPress
Affected versions: <=1.6.9
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-authorize.net-payment-gateway (WordPress plugin) WordPress
Affected versions: <=1.1.12
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-badge-management (WordPress plugin) WordPress
Affected versions: <=1.3.19
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-best-sellers (WordPress plugin) WordPress
Affected versions: <=1.1.11
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-brands-add-on (WordPress plugin) WordPress
Affected versions: <=1.3.6
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-bulk-product-editing (WordPress plugin) WordPress
Affected versions: <=1.2.13
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-cart-messages (WordPress plugin) WordPress
Affected versions: <=1.4.3
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-compare (WordPress plugin) WordPress
Affected versions: <=2.3.13
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-frequently-bought-together (WordPress plugin) WordPress
Affected versions: <=1.2.10
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-gift-cards (WordPress plugin) WordPress
Affected versions: <=1.3.7
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-mailchimp (WordPress plugin) WordPress
Affected versions: <=2.1.3
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-multi-step-checkout (WordPress plugin) WordPress
Affected versions: <=1.7.4
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-multi-vendor (WordPress plugin) WordPress
Affected versions: <=3.4.0
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-order-tracking (WordPress plugin) WordPress
Affected versions: <=1.2.10
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-pdf-invoice-and-shipping-list (WordPress plugin) WordPress
Affected versions: <=1.2.12
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-points-and-rewards (WordPress plugin) WordPress
Affected versions: <=1.3.4
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-product-add-ons (WordPress plugin) WordPress
Affected versions: <=1.5.21
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-product-bundles (WordPress plugin) WordPress
Affected versions: <=1.1.15
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-questions-and-answers (WordPress plugin) WordPress
Affected versions: <=1.1.9
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-quick-view (WordPress plugin) WordPress
Affected versions: <=1.3.13
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-recover-abandoned-cart (WordPress plugin) WordPress
Affected versions: <=1.3.2
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-request-a-quote (WordPress plugin) WordPress
Affected versions: <=1.4.7
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-social-login (WordPress plugin) WordPress
Affected versions: <=1.3.4
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-stripe (WordPress plugin) WordPress
Affected versions: <=2.0.1
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-subscription (WordPress plugin) WordPress
Affected versions: <=1.3.4
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-waiting-list (WordPress plugin) WordPress
Affected versions: <=1.3.9
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-wishlist (WordPress plugin) WordPress
Affected versions: <=2.2.13
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.

Package: yith-woocommerce-zoom-magnifier (WordPress plugin) WordPress
Affected versions: <=1.3.11
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 1% (61.0th percentile)
Published: 2019-10-31
Source: nvd

References

NVD record yith-advanced-refund-system-for-woocommerce (WordPress plugin) advisories yith-color-and-label-variations-for-woocommerce (WordPress plugin) advisories yith-custom-thank-you-page-for-woocommerce (WordPress plugin) advisories yith-desktop-notifications-for-woocommerce (WordPress plugin) advisories yith-paypal-express-checkout-for-woocommerce (WordPress plugin) advisories yith-pre-order-for-woocommerce (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2019-11043 KEV critical PHP-FPM remote code execution via env_path_info buffer underflow also from 2019
CVE-2019-6340 KEV high Some field types do not properly sanitize data from non-form sources. This can lead to arb also from 2019
CVE-2019-9978 KEV medium The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin also from 2019
CVE-2019-9194 critical elFinder command injection vulnerability in the PHP connector also from 2019
CVE-2019-8943 medium WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has pri also from 2019
CVE-2019-11358 medium XSS in jQuery as used in Drupal, Backdrop CMS, and other products also from 2019